2022-02-10 01:32:44 +01:00
|
|
|
# platform should have ownership of network attachpoints for BPF
|
|
|
|
|
neverallow {
|
|
|
|
|
bpfdomain
|
|
|
|
|
-bpfloader
|
|
|
|
|
-netd
|
|
|
|
|
-netutils_wrapper
|
|
|
|
|
-network_stack
|
|
|
|
|
-system_server
|
|
|
|
|
} self:global_capability_class_set { net_admin net_raw };
|
|
|
|
|
|
|
|
|
|
# any domain which uses bpf is a bpfdomain
|
|
|
|
|
neverallow { domain -bpfdomain } *:bpf *;
|
|
|
|
|
|
2022-03-22 01:31:14 +01:00
|
|
|
allow bpfdomain fs_bpf:dir search;
|
2022-07-18 12:34:30 +02:00
|
|
|
|
|
|
|
|
# genfscon doesn't seem to trigger during symlink creation,
|
|
|
|
|
# and thus any created symlinks end up as 'fs_bpf:lnk_type',
|
|
|
|
|
# however this feels like a kernel bug / missing feature,
|
|
|
|
|
# so let's allow all bpffs_type's instead,
|
|
|
|
|
# this will keep things working even if this is fixed.
|
|
|
|
|
allow bpfdomain bpffs_type:lnk_file read;
|
2023-01-06 11:07:02 +01:00
|
|
|
|
|
|
|
|
# Needed for //frameworks/libs/net:
|
|
|
|
|
# common/native/bpf_headers/include/bpf/WaitForProgsLoaded.h
|
|
|
|
|
get_prop(bpfdomain, bpf_progs_loaded_prop)
|
